API reference

curl -X POST https://app.flik.co.nz/api/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "clientId=$FLIK_CLIENT_ID" \
  -d "clientSecret=$FLIK_CLIENT_SECRET"

const BASE = "https://app.flik.co.nz";

async function getToken() {
  const res = await fetch(`${BASE}/api/token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      clientId: process.env.FLIK_CLIENT_ID,
      clientSecret: process.env.FLIK_CLIENT_SECRET,
    }),
  });

  if (!res.ok) throw new Error(`Token request failed: ${res.status}`);

  const { accessToken } = await res.json();
  return accessToken; // good for an hour
}

import os
import requests

BASE = "https://app.flik.co.nz"


def get_token():
    res = requests.post(
        f"{BASE}/api/token",
        data={
            "clientId": os.environ["FLIK_CLIENT_ID"],
            "clientSecret": os.environ["FLIK_CLIENT_SECRET"],
        },
        timeout=15,
    )
    res.raise_for_status()

    return res.json()["accessToken"]  # good for an hour

<?php

const FLIK_BASE = 'https://app.flik.co.nz';

function flik_token(): string
{
    $ch = curl_init(FLIK_BASE . '/api/token');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POSTFIELDS     => http_build_query([
            'clientId'     => getenv('FLIK_CLIENT_ID'),
            'clientSecret' => getenv('FLIK_CLIENT_SECRET'),
        ]),
    ]);

    $response = curl_exec($ch);
    $status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($status !== 200) {
        throw new RuntimeException('Token request failed');
    }

    return json_decode($response, true)['accessToken'];
}

curl -X POST https://app.flik.co.nz/api/checkout-sessions \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-5591" \
  -d '{
    "type": "single",
    "amount": { "total": 25.00 },
    "creditorReference": {
      "reference": "INV-1001",
      "particulars": "Acme Ltd",
      "code": "ACME"
    },
    "checkoutMethod": "both",
    "redirectUrl": "https://example.com/thanks",
    "webhookUrl": "https://example.com/flik/webhook",
    "foreignTransactionId": "order-5591",
    "description": "Order 5591, two items"
  }'

const BASE = "https://app.flik.co.nz";

async function createSession(token, order) {
  const res = await fetch(`${BASE}/api/checkout-sessions`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
      "Idempotency-Key": order.id,
    },
    body: JSON.stringify({
      type: "single",
      amount: { total: order.total },
      creditorReference: {
        reference: order.invoiceNumber,
        particulars: "Acme Ltd",
        code: "ACME",
      },
      checkoutMethod: "both",
      redirectUrl: "https://example.com/thanks",
      webhookUrl: "https://example.com/flik/webhook",
      foreignTransactionId: order.id,
    }),
  });

  const body = await res.json();

  if (!res.ok) {
    throw Object.assign(new Error(body.error.message), {
      code: body.error.code,
      param: body.error.param,
    });
  }

  // Store body.id against the order, then redirect to body.url.
  return body;
}

import requests

BASE = "https://app.flik.co.nz"


def create_session(token, order):
    res = requests.post(
        f"{BASE}/api/checkout-sessions",
        headers={
            "Authorization": f"Bearer {token}",
            "Idempotency-Key": order["id"],
        },
        json={
            "type": "single",
            "amount": {"total": order["total"]},
            "creditorReference": {
                "reference": order["invoice_number"],
                "particulars": "Acme Ltd",
                "code": "ACME",
            },
            "checkoutMethod": "both",
            "redirectUrl": "https://example.com/thanks",
            "webhookUrl": "https://example.com/flik/webhook",
            "foreignTransactionId": order["id"],
        },
        timeout=15,
    )

    body = res.json()
    if not res.ok:
        raise RuntimeError(body["error"]["code"])

    # Store body["id"] against the order, then redirect to body["url"].
    return body

<?php

const FLIK_BASE = 'https://app.flik.co.nz';

function flik_create_session(string $token, array $order): array
{
    $ch = curl_init(FLIK_BASE . '/api/checkout-sessions');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'Authorization: Bearer ' . $token,
            'Content-Type: application/json',
            'Idempotency-Key: ' . $order['id'],
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'type'   => 'single',
            'amount' => ['total' => $order['total']],
            'creditorReference' => [
                'reference'   => $order['invoice_number'],
                'particulars' => 'Acme Ltd',
                'code'        => 'ACME',
            ],
            'checkoutMethod'       => 'both',
            'redirectUrl'          => 'https://example.com/thanks',
            'webhookUrl'           => 'https://example.com/flik/webhook',
            'foreignTransactionId' => $order['id'],
        ]),
    ]);

    $response = curl_exec($ch);
    $status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $body = json_decode($response, true);

    if ($status !== 200) {
        throw new RuntimeException($body['error']['code']);
    }

    // Store $body['id'] against the order, then redirect to $body['url'].
    return $body;
}

curl https://app.flik.co.nz/api/checkout-sessions/cs_7Hk2pQr4TnVxWy9BdLmE \
  -H "Authorization: Bearer $TOKEN"

const BASE = "https://app.flik.co.nz";

async function getSession(token, sessionId) {
  const res = await fetch(`${BASE}/api/checkout-sessions/${sessionId}`, {
    headers: { Authorization: `Bearer ${token}` },
  });

  if (res.status === 404) return null;

  const body = await res.json();
  if (!res.ok) throw new Error(body.error.code);

  // Fulfil only on "completed".
  return body;
}

import requests

BASE = "https://app.flik.co.nz"


def get_session(token, session_id):
    res = requests.get(
        f"{BASE}/api/checkout-sessions/{session_id}",
        headers={"Authorization": f"Bearer {token}"},
        timeout=15,
    )

    if res.status_code == 404:
        return None

    body = res.json()
    if not res.ok:
        raise RuntimeError(body["error"]["code"])

    # Fulfil only on "completed".
    return body

<?php

const FLIK_BASE = 'https://app.flik.co.nz';

function flik_get_session(string $token, string $sessionId): ?array
{
    $ch = curl_init(FLIK_BASE . '/api/checkout-sessions/' . $sessionId);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $token],
    ]);

    $response = curl_exec($ch);
    $status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($status === 404) {
        return null;
    }

    // Fulfil only on "completed".
    return json_decode($response, true);
}

curl -X POST https://app.flik.co.nz/api/payment-links \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "single",
    "amount": { "total": 250.00 },
    "creditorReference": {
      "reference": "INV-1001",
      "particulars": "Acme Ltd",
      "code": "ORD-5591"
    },
    "checkoutMethod": "both",
    "webhookUrl": "https://example.org/flik/webhook",
    "foreignTransactionId": "invoice-1001"
  }'

const BASE = "https://app.flik.co.nz";

async function createPaymentLink(token) {
  const res = await fetch(`${BASE}/api/payment-links`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      type: "single",
      amount: { total: invoice.total },
      creditorReference: {
        reference: invoice.number,
        particulars: "Acme Ltd",
        code: invoice.id,
      },
      checkoutMethod: "both",
      webhookUrl: "https://example.org/flik/webhook",
      foreignTransactionId: invoice.id,
    }),
  });

  const body = await res.json();
  if (!res.ok) throw new Error(body.error.code);

  // Publish body.url. Do not rebuild it from body.id.
  return body;
}

import requests

BASE = "https://app.flik.co.nz"


def create_payment_link(token):
    res = requests.post(
        f"{BASE}/api/payment-links",
        headers={"Authorization": f"Bearer {token}"},
        json={
            "type": "single",
            "amount": {"total": invoice["total"]},
            "creditorReference": {
                "reference": invoice["number"],
                "particulars": "Acme Ltd",
                "code": invoice["id"],
            },
            "checkoutMethod": "both",
            "webhookUrl": "https://example.org/flik/webhook",
            "foreignTransactionId": invoice["id"],
        },
        timeout=15,
    )

    body = res.json()
    if not res.ok:
        raise RuntimeError(body["error"]["code"])

    # Store body["url"] — it is not returned again.
    return body

<?php

const FLIK_BASE = 'https://app.flik.co.nz';

function flik_create_payment_link(string $token): array
{
    $ch = curl_init(FLIK_BASE . '/api/payment-links');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'Authorization: Bearer ' . $token,
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'type'   => 'single',
            'amount' => ['total' => $invoice['total']],
            'creditorReference' => [
                'reference'   => $invoice['number'],
                'particulars' => 'Acme Ltd',
                'code'        => $invoice['id'],
            ],
            'checkoutMethod'       => 'both',
            'webhookUrl'           => 'https://example.org/flik/webhook',
            'foreignTransactionId' => $invoice['id'],
        ]),
    ]);

    $response = curl_exec($ch);
    $status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $body = json_decode($response, true);

    if ($status !== 200) {
        throw new RuntimeException($body['error']['code']);
    }

    // Publish $body['url'].
    return $body;
}

curl https://app.flik.co.nz/api/payment-links/7b3e4d21-9a6c-4f08-b512-6de3a9c47f10 \
  -H "Authorization: Bearer $TOKEN"

const BASE = "https://app.flik.co.nz";

async function getPaymentLink(token, id) {
  const res = await fetch(`${BASE}/api/payment-links/${id}`, {
    headers: { Authorization: `Bearer ${token}` },
  });

  // 404 means "no such link, or not yours".
  if (res.status === 404) return null;

  const body = await res.json();
  if (!res.ok) throw new Error(body.error.code);

  return body;
}

import requests

BASE = "https://app.flik.co.nz"


def get_payment_link(token, link_id):
    res = requests.get(
        f"{BASE}/api/payment-links/{link_id}",
        headers={"Authorization": f"Bearer {token}"},
        timeout=15,
    )

    # 404 means "no such link, or not yours".
    if res.status_code == 404:
        return None

    body = res.json()
    if not res.ok:
        raise RuntimeError(body["error"]["code"])

    return body

<?php

const FLIK_BASE = 'https://app.flik.co.nz';

function flik_get_payment_link(string $token, string $id): ?array
{
    $ch = curl_init(FLIK_BASE . '/api/payment-links/' . $id);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $token],
    ]);

    $response = curl_exec($ch);
    $status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    // 404 means "no such link, or not yours".
    if ($status === 404) {
        return null;
    }

    return json_decode($response, true);
}